n8n Authorization Bypass Vulnerability in Workflow Test Run Endpoint

A vulnerability exists in n8n versions prior to 1.123.55, 2.25.7, and 2.26.2, allowing an authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint. This endpoint incorrectly authorizes access using the workflow:read scope instead of workflow:execute. As a result, an authenticated user with read-only access to a workflow can initiate a real evaluation test run. This execution occurs through the internal workflow runner, potentially leading to unintended outbound API calls, data changes, or other side effects in connected downstream systems. The vulnerability is particularly relevant for instances using the Evaluations feature, where RBAC project roles provide workflow:read access without workflow:execute.

Impact

Exploitation of this vulnerability allows unauthorized execution of workflows, causing them to run via the internal workflow runner. This can result in unintended API calls, data mutations, or other side effects in downstream systems connected to the workflow.

Remediation

Users should upgrade to n8n versions 1.123.55, 2.25.7, or 2.26.2. If an immediate upgrade is not possible, restrict workflow access to trusted users and audit project role assignments to limit workflow:read access on sensitive workflows.